Analysis
- max time kernel
130s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 14:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_112e4c8db2b66994c10e908a6e063817_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_112e4c8db2b66994c10e908a6e063817_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-09_112e4c8db2b66994c10e908a6e063817_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260809-sacphstsbz
- SHA256 71bebb62954b547ac2177bd034d69088479220f41267178335788fe92c857993
- MD5 112e4c8db2b66994c10e908a6e063817
- SHA1 6d75ea22de84cd11cb04148bd86f320c1ad12e11
- SHA512 07c7f2716469462a5a2b6290152bea94efd44abb8be36527c9460bd2adb28f9323f171dbcb19b0abae1def52d86a54991a0450e323597e695c56bd35ef66a70b
- SSDEEP 12288:NU5rCOTeijUx7vC+RBStd008rMDNmklwXEvMTZwlH:NUQOJjuqVD0zeNNNvMTSlH
- TLSH T126B4F125B285C132E5D212710AD6EBB16D7ABC325726A4C37B98623E2FB13D1D3B5307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6952 AF70.tmp 6600 AFFD.tmp 6612 B0C8.tmp 7148 B193.tmp 5272 B22F.tmp 4296 B30A.tmp 3676 B387.tmp 1692 B462.tmp 4336 B4FE.tmp 4376 B58B.tmp 7152 B617.tmp 6608 B6D3.tmp 5992 B78E.tmp 6492 B82B.tmp 4780 B8D6.tmp 804 B963.tmp 4308 B9FF.tmp 7128 BA9C.tmp 4832 BB47.tmp 2680 BC03.tmp 5016 BCAF.tmp 2856 BD99.tmp 4260 BE93.tmp 3524 BF3F.tmp 4224 BFEB.tmp 3280 C0B6.tmp 4264 C191.tmp 1428 C26C.tmp 4208 C2E9.tmp 4700 C3C3.tmp 5468 C49E.tmp 6196 C54A.tmp 5540 C5F6.tmp 6296 C663.tmp 7076 C6D1.tmp 4852 C75D.tmp 2796 C7F9.tmp 5128 C876.tmp 6364 C8E4.tmp 6744 C990.tmp 6696 CA0D.tmp 6712 CA8A.tmp 3112 CB16.tmp 1780 CBB3.tmp 5760 CC20.tmp 6772 CC8D.tmp 6616 CD0A.tmp 4256 CD87.tmp 1084 CDF5.tmp 3672 CE81.tmp 6280 CEFE.tmp 1756 CF9B.tmp 7116 D027.tmp 4856 D095.tmp 3336 D121.tmp 2244 D1CD.tmp 2804 D269.tmp 6700 D2E6.tmp 5080 D354.tmp 2848 D3D1.tmp 4332 D44E.tmp 6804 D4CB.tmp 1560 D548.tmp 2060 D5E4.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 282.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8903.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D027.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 226E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 596C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 849.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5020.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3133.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C26C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8569.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1619.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 635F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E427.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A45B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1895.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 941E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F999.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4344.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A54A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BE1.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3576 wrote to memory of 6952 3576 2026-08-09_112e4c8db2b66994c10e908a6e063817_elex_mafia_stealc_tofsee.exe 89 PID 6952 wrote to memory of 6600 6952 AF70.tmp 90 PID 6600 wrote to memory of 6612 6600 AFFD.tmp 91 PID 6612 wrote to memory of 7148 6612 B0C8.tmp 92 PID 7148 wrote to memory of 5272 7148 B193.tmp 93 PID 5272 wrote to memory of 4296 5272 B22F.tmp 94 PID 4296 wrote to memory of 3676 4296 B30A.tmp 95 PID 3676 wrote to memory of 1692 3676 B387.tmp 96 PID 1692 wrote to memory of 4336 1692 B462.tmp 97 PID 4336 wrote to memory of 4376 4336 B4FE.tmp 98 PID 4376 wrote to memory of 7152 4376 B58B.tmp 99 PID 7152 wrote to memory of 6608 7152 B617.tmp 100 PID 6608 wrote to memory of 5992 6608 B6D3.tmp 101 PID 5992 wrote to memory of 6492 5992 B78E.tmp 102 PID 6492 wrote to memory of 4780 6492 B82B.tmp 103 PID 4780 wrote to memory of 804 4780 B8D6.tmp 104 PID 804 wrote to memory of 4308 804 B963.tmp 105 PID 4308 wrote to memory of 7128 4308 B9FF.tmp 106 PID 7128 wrote to memory of 4832 7128 BA9C.tmp 107 PID 4832 wrote to memory of 2680 4832 BB47.tmp 108 PID 2680 wrote to memory of 5016 2680 BC03.tmp 109 PID 5016 wrote to memory of 2856 5016 BCAF.tmp 110 PID 2856 wrote to memory of 4260 2856 BD99.tmp 111 PID 4260 wrote to memory of 3524 4260 BE93.tmp 112 PID 3524 wrote to memory of 4224 3524 BF3F.tmp 113 PID 4224 wrote to memory of 3280 4224 BFEB.tmp 114 PID 3280 wrote to memory of 4264 3280 C0B6.tmp 115 PID 4264 wrote to memory of 1428 4264 C191.tmp 116 PID 1428 wrote to memory of 4208 1428 C26C.tmp 117 PID 4208 wrote to memory of 4700 4208 C2E9.tmp 118 PID 4700 wrote to memory of 5468 4700 C3C3.tmp 119 PID 5468 wrote to memory of 6196 5468 C49E.tmp 120 PID 6196 wrote to memory of 5540 6196 C54A.tmp 121 PID 5540 wrote to memory of 6296 5540 C5F6.tmp 122 PID 6296 wrote to memory of 7076 6296 C663.tmp 123 PID 7076 wrote to memory of 4852 7076 C6D1.tmp 124 PID 4852 wrote to memory of 2796 4852 C75D.tmp 125 PID 2796 wrote to memory of 5128 2796 C7F9.tmp 126 PID 5128 wrote to memory of 6364 5128 C876.tmp 127 PID 6364 wrote to memory of 6744 6364 C8E4.tmp 128 PID 6744 wrote to memory of 6696 6744 C990.tmp 129 PID 6696 wrote to memory of 6712 6696 CA0D.tmp 130 PID 6712 wrote to memory of 3112 6712 CA8A.tmp 131 PID 3112 wrote to memory of 1780 3112 CB16.tmp 132 PID 1780 wrote to memory of 5760 1780 CBB3.tmp 133 PID 5760 wrote to memory of 6772 5760 CC20.tmp 134 PID 6772 wrote to memory of 6616 6772 CC8D.tmp 135 PID 6616 wrote to memory of 4256 6616 CD0A.tmp 136 PID 4256 wrote to memory of 1084 4256 CD87.tmp 137 PID 1084 wrote to memory of 3672 1084 CDF5.tmp 138 PID 3672 wrote to memory of 6280 3672 CE81.tmp 139 PID 6280 wrote to memory of 1756 6280 CEFE.tmp 140 PID 1756 wrote to memory of 7116 1756 CF9B.tmp 141 PID 7116 wrote to memory of 4856 7116 D027.tmp 142 PID 4856 wrote to memory of 3336 4856 D095.tmp 143 PID 3336 wrote to memory of 2244 3336 D121.tmp 144 PID 2244 wrote to memory of 2804 2244 D1CD.tmp 145 PID 2804 wrote to memory of 6700 2804 D269.tmp 146 PID 6700 wrote to memory of 5080 6700 D2E6.tmp 147 PID 5080 wrote to memory of 2848 5080 D354.tmp 148 PID 2848 wrote to memory of 4332 2848 D3D1.tmp 149 PID 4332 wrote to memory of 6804 4332 D44E.tmp 150 PID 6804 wrote to memory of 1560 6804 D4CB.tmp 151 PID 1560 wrote to memory of 2060 1560 D548.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_112e4c8db2b66994c10e908a6e063817_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_112e4c8db2b66994c10e908a6e063817_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\AF70.tmp"C:\Users\Admin\AppData\Local\Temp\AF70.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6952 -
C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"C:\Users\Admin\AppData\Local\Temp\AFFD.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6600 -
C:\Users\Admin\AppData\Local\Temp\B0C8.tmp"C:\Users\Admin\AppData\Local\Temp\B0C8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6612 -
C:\Users\Admin\AppData\Local\Temp\B193.tmp"C:\Users\Admin\AppData\Local\Temp\B193.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7148 -
C:\Users\Admin\AppData\Local\Temp\B22F.tmp"C:\Users\Admin\AppData\Local\Temp\B22F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\B462.tmp"C:\Users\Admin\AppData\Local\Temp\B462.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\B4FE.tmp"C:\Users\Admin\AppData\Local\Temp\B4FE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\B58B.tmp"C:\Users\Admin\AppData\Local\Temp\B58B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\B617.tmp"C:\Users\Admin\AppData\Local\Temp\B617.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7152 -
C:\Users\Admin\AppData\Local\Temp\B6D3.tmp"C:\Users\Admin\AppData\Local\Temp\B6D3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6608 -
C:\Users\Admin\AppData\Local\Temp\B78E.tmp"C:\Users\Admin\AppData\Local\Temp\B78E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\B82B.tmp"C:\Users\Admin\AppData\Local\Temp\B82B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6492 -
C:\Users\Admin\AppData\Local\Temp\B8D6.tmp"C:\Users\Admin\AppData\Local\Temp\B8D6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\B963.tmp"C:\Users\Admin\AppData\Local\Temp\B963.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\B9FF.tmp"C:\Users\Admin\AppData\Local\Temp\B9FF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\BA9C.tmp"C:\Users\Admin\AppData\Local\Temp\BA9C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7128 -
C:\Users\Admin\AppData\Local\Temp\BB47.tmp"C:\Users\Admin\AppData\Local\Temp\BB47.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\BC03.tmp"C:\Users\Admin\AppData\Local\Temp\BC03.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\BCAF.tmp"C:\Users\Admin\AppData\Local\Temp\BCAF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\BD99.tmp"C:\Users\Admin\AppData\Local\Temp\BD99.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\BE93.tmp"C:\Users\Admin\AppData\Local\Temp\BE93.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\BF3F.tmp"C:\Users\Admin\AppData\Local\Temp\BF3F.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\C0B6.tmp"C:\Users\Admin\AppData\Local\Temp\C0B6.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\C191.tmp"C:\Users\Admin\AppData\Local\Temp\C191.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\C26C.tmp"C:\Users\Admin\AppData\Local\Temp\C26C.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\C3C3.tmp"C:\Users\Admin\AppData\Local\Temp\C3C3.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\C49E.tmp"C:\Users\Admin\AppData\Local\Temp\C49E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Users\Admin\AppData\Local\Temp\C54A.tmp"C:\Users\Admin\AppData\Local\Temp\C54A.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6196 -
C:\Users\Admin\AppData\Local\Temp\C5F6.tmp"C:\Users\Admin\AppData\Local\Temp\C5F6.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\C663.tmp"C:\Users\Admin\AppData\Local\Temp\C663.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6296 -
C:\Users\Admin\AppData\Local\Temp\C6D1.tmp"C:\Users\Admin\AppData\Local\Temp\C6D1.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7076 -
C:\Users\Admin\AppData\Local\Temp\C75D.tmp"C:\Users\Admin\AppData\Local\Temp\C75D.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\C7F9.tmp"C:\Users\Admin\AppData\Local\Temp\C7F9.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\C876.tmp"C:\Users\Admin\AppData\Local\Temp\C876.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6364 -
C:\Users\Admin\AppData\Local\Temp\C990.tmp"C:\Users\Admin\AppData\Local\Temp\C990.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6744 -
C:\Users\Admin\AppData\Local\Temp\CA0D.tmp"C:\Users\Admin\AppData\Local\Temp\CA0D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6696 -
C:\Users\Admin\AppData\Local\Temp\CA8A.tmp"C:\Users\Admin\AppData\Local\Temp\CA8A.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6712 -
C:\Users\Admin\AppData\Local\Temp\CB16.tmp"C:\Users\Admin\AppData\Local\Temp\CB16.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\CBB3.tmp"C:\Users\Admin\AppData\Local\Temp\CBB3.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\CC20.tmp"C:\Users\Admin\AppData\Local\Temp\CC20.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"C:\Users\Admin\AppData\Local\Temp\CC8D.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6772 -
C:\Users\Admin\AppData\Local\Temp\CD0A.tmp"C:\Users\Admin\AppData\Local\Temp\CD0A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6616 -
C:\Users\Admin\AppData\Local\Temp\CD87.tmp"C:\Users\Admin\AppData\Local\Temp\CD87.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\CDF5.tmp"C:\Users\Admin\AppData\Local\Temp\CDF5.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\CE81.tmp"C:\Users\Admin\AppData\Local\Temp\CE81.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\CEFE.tmp"C:\Users\Admin\AppData\Local\Temp\CEFE.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6280 -
C:\Users\Admin\AppData\Local\Temp\CF9B.tmp"C:\Users\Admin\AppData\Local\Temp\CF9B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\D027.tmp"C:\Users\Admin\AppData\Local\Temp\D027.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7116 -
C:\Users\Admin\AppData\Local\Temp\D095.tmp"C:\Users\Admin\AppData\Local\Temp\D095.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\D121.tmp"C:\Users\Admin\AppData\Local\Temp\D121.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\D1CD.tmp"C:\Users\Admin\AppData\Local\Temp\D1CD.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\D269.tmp"C:\Users\Admin\AppData\Local\Temp\D269.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\D2E6.tmp"C:\Users\Admin\AppData\Local\Temp\D2E6.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6700 -
C:\Users\Admin\AppData\Local\Temp\D354.tmp"C:\Users\Admin\AppData\Local\Temp\D354.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"C:\Users\Admin\AppData\Local\Temp\D3D1.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\D44E.tmp"C:\Users\Admin\AppData\Local\Temp\D44E.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\D4CB.tmp"C:\Users\Admin\AppData\Local\Temp\D4CB.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6804 -
C:\Users\Admin\AppData\Local\Temp\D548.tmp"C:\Users\Admin\AppData\Local\Temp\D548.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"65⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\D661.tmp"C:\Users\Admin\AppData\Local\Temp\D661.tmp"66⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\D6EE.tmp"C:\Users\Admin\AppData\Local\Temp\D6EE.tmp"67⤵PID:5584
-
C:\Users\Admin\AppData\Local\Temp\D76B.tmp"C:\Users\Admin\AppData\Local\Temp\D76B.tmp"68⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"69⤵PID:6532
-
C:\Users\Admin\AppData\Local\Temp\D865.tmp"C:\Users\Admin\AppData\Local\Temp\D865.tmp"70⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"71⤵PID:7060
-
C:\Users\Admin\AppData\Local\Temp\D96E.tmp"C:\Users\Admin\AppData\Local\Temp\D96E.tmp"72⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"73⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\DAA7.tmp"C:\Users\Admin\AppData\Local\Temp\DAA7.tmp"74⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\DB43.tmp"C:\Users\Admin\AppData\Local\Temp\DB43.tmp"75⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\DBB0.tmp"C:\Users\Admin\AppData\Local\Temp\DBB0.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"77⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\DCBA.tmp"C:\Users\Admin\AppData\Local\Temp\DCBA.tmp"78⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\DD47.tmp"C:\Users\Admin\AppData\Local\Temp\DD47.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\DDC4.tmp"C:\Users\Admin\AppData\Local\Temp\DDC4.tmp"80⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\DE50.tmp"C:\Users\Admin\AppData\Local\Temp\DE50.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:6464 -
C:\Users\Admin\AppData\Local\Temp\DECD.tmp"C:\Users\Admin\AppData\Local\Temp\DECD.tmp"82⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\DF5A.tmp"C:\Users\Admin\AppData\Local\Temp\DF5A.tmp"83⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\DFC7.tmp"C:\Users\Admin\AppData\Local\Temp\DFC7.tmp"84⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\E054.tmp"C:\Users\Admin\AppData\Local\Temp\E054.tmp"85⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\E0D1.tmp"C:\Users\Admin\AppData\Local\Temp\E0D1.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:960 -
C:\Users\Admin\AppData\Local\Temp\E14E.tmp"C:\Users\Admin\AppData\Local\Temp\E14E.tmp"87⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\E1CB.tmp"C:\Users\Admin\AppData\Local\Temp\E1CB.tmp"88⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\E248.tmp"C:\Users\Admin\AppData\Local\Temp\E248.tmp"89⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\E2C5.tmp"C:\Users\Admin\AppData\Local\Temp\E2C5.tmp"90⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\E351.tmp"C:\Users\Admin\AppData\Local\Temp\E351.tmp"91⤵PID:6856
-
C:\Users\Admin\AppData\Local\Temp\E3DE.tmp"C:\Users\Admin\AppData\Local\Temp\E3DE.tmp"92⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\E45B.tmp"C:\Users\Admin\AppData\Local\Temp\E45B.tmp"93⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\E4C8.tmp"C:\Users\Admin\AppData\Local\Temp\E4C8.tmp"94⤵PID:6880
-
C:\Users\Admin\AppData\Local\Temp\E536.tmp"C:\Users\Admin\AppData\Local\Temp\E536.tmp"95⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\E5A3.tmp"C:\Users\Admin\AppData\Local\Temp\E5A3.tmp"96⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\E63F.tmp"C:\Users\Admin\AppData\Local\Temp\E63F.tmp"97⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\E6BC.tmp"C:\Users\Admin\AppData\Local\Temp\E6BC.tmp"98⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\E739.tmp"C:\Users\Admin\AppData\Local\Temp\E739.tmp"99⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"100⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\E843.tmp"C:\Users\Admin\AppData\Local\Temp\E843.tmp"101⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\E8DF.tmp"C:\Users\Admin\AppData\Local\Temp\E8DF.tmp"102⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\E95C.tmp"C:\Users\Admin\AppData\Local\Temp\E95C.tmp"103⤵PID:7164
-
C:\Users\Admin\AppData\Local\Temp\E9F9.tmp"C:\Users\Admin\AppData\Local\Temp\E9F9.tmp"104⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\EA76.tmp"C:\Users\Admin\AppData\Local\Temp\EA76.tmp"105⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\EB02.tmp"C:\Users\Admin\AppData\Local\Temp\EB02.tmp"106⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\EB8F.tmp"C:\Users\Admin\AppData\Local\Temp\EB8F.tmp"107⤵PID:6068
-
C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"108⤵PID:6480
-
C:\Users\Admin\AppData\Local\Temp\ECA8.tmp"C:\Users\Admin\AppData\Local\Temp\ECA8.tmp"109⤵PID:360
-
C:\Users\Admin\AppData\Local\Temp\ED35.tmp"C:\Users\Admin\AppData\Local\Temp\ED35.tmp"110⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\EDC1.tmp"C:\Users\Admin\AppData\Local\Temp\EDC1.tmp"111⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\EE2F.tmp"C:\Users\Admin\AppData\Local\Temp\EE2F.tmp"112⤵PID:5236
-
C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"113⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\EF38.tmp"C:\Users\Admin\AppData\Local\Temp\EF38.tmp"114⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\EFB5.tmp"C:\Users\Admin\AppData\Local\Temp\EFB5.tmp"115⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\F023.tmp"C:\Users\Admin\AppData\Local\Temp\F023.tmp"116⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\F0AF.tmp"C:\Users\Admin\AppData\Local\Temp\F0AF.tmp"117⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\F14C.tmp"C:\Users\Admin\AppData\Local\Temp\F14C.tmp"118⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\F1C9.tmp"C:\Users\Admin\AppData\Local\Temp\F1C9.tmp"119⤵PID:7160
-
C:\Users\Admin\AppData\Local\Temp\F246.tmp"C:\Users\Admin\AppData\Local\Temp\F246.tmp"120⤵PID:6884
-
C:\Users\Admin\AppData\Local\Temp\F2D2.tmp"C:\Users\Admin\AppData\Local\Temp\F2D2.tmp"121⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\F35F.tmp"C:\Users\Admin\AppData\Local\Temp\F35F.tmp"122⤵PID:4664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-